From 6711c9bff5c921ddb73a1faf5c298702600499fc Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Wed, 30 Sep 2026 13:27:19 +0800
Subject: [PATCH] =?UTF-8?q?=E6=94=B6=E6=95=9B=E6=95=B0=E6=8D=AE=E5=BA=93?=
 =?UTF-8?q?=E9=AA=8C=E8=AF=81=E5=8F=96=E6=B6=88=E8=BE=B9=E7=95=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

增加验证请求上下文取消检查，并串行化临时凭据删除操作，继续保持 P0-03 待复审状态。
---
 backend/internal/bootstrap/database.go | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/backend/internal/bootstrap/database.go b/backend/internal/bootstrap/database.go
index d63d060..ce2a677 100644
--- a/backend/internal/bootstrap/database.go
+++ b/backend/internal/bootstrap/database.go
@@ -76,6 +76,7 @@ type DatabaseVerificationSession struct {
 
 type DatabaseVerificationManager struct {
 	mu             sync.Mutex
+	cleanupMu      sync.Mutex
 	base           config.Config
 	store          DatabaseSecretStore
 	verify         func(context.Context, config.DatabaseConfig) error
@@ -99,6 +100,9 @@ func (m *DatabaseVerificationManager) Verify(ctx context.Context, input Database
 	if m == nil || m.verify == nil || m.store == nil {
 		return DatabaseVerificationResult{}, errors.New("数据库验证服务尚未初始化")
 	}
+	if err := ctx.Err(); err != nil {
+		return DatabaseVerificationResult{}, err
+	}
 	m.retryPendingCredentialCleanup()
 	if err := m.reserve(); err != nil {
 		return DatabaseVerificationResult{}, err
@@ -110,6 +114,9 @@ func (m *DatabaseVerificationManager) Verify(ctx context.Context, input Database
 		}
 	}()
 
+	if err := ctx.Err(); err != nil {
+		return DatabaseVerificationResult{}, err
+	}
 	persisted, credentials, err := buildDatabaseConfig(m.base, input)
 	if err != nil {
 		return DatabaseVerificationResult{}, err
@@ -131,6 +138,9 @@ func (m *DatabaseVerificationManager) Verify(ctx context.Context, input Database
 			return DatabaseVerificationResult{}, fmt.Errorf("加密保存数据库凭据失败：%w", err)
 		}
 	}
+	if err := ctx.Err(); err != nil {
+		return DatabaseVerificationResult{}, err
+	}
 	resolved, err := database.ResolveConfig(ctx, persisted, m.store)
 	if err != nil {
 		return DatabaseVerificationResult{}, err
@@ -138,6 +148,9 @@ func (m *DatabaseVerificationManager) Verify(ctx context.Context, input Database
 	if err := m.verify(ctx, resolved); err != nil {
 		return DatabaseVerificationResult{}, fmt.Errorf("数据库连接或写权限验证失败：%w", err)
 	}
+	if err := ctx.Err(); err != nil {
+		return DatabaseVerificationResult{}, err
+	}
 	token, err := randomToken(32)
 	if err != nil {
 		return DatabaseVerificationResult{}, fmt.Errorf("生成数据库验证令牌失败：%w", err)
@@ -207,8 +220,10 @@ func (m *DatabaseVerificationManager) Discard(token string) error {
 	m.mu.Lock()
 	expired := m.clearExpiredLocked(now)
 	session, ok := m.sessions[token]
+	entry := expiredDatabaseVerificationSession{Token: token, Session: session}
 	if ok {
 		delete(m.sessions, token)
+		m.expiredSession[token] = entry
 	}
 	m.mu.Unlock()
 	m.deleteExpiredSessions(expired)
@@ -216,7 +231,7 @@ func (m *DatabaseVerificationManager) Discard(token string) error {
 		return errors.New("数据库验证令牌无效或已经过期")
 	}
 	if err := m.deleteCredential(session.CredentialRef); err != nil {
-		m.restoreSession(token, session)
+		m.restoreExpiredSession(entry)
 		return errors.New("数据库临时凭据回收失败")
 	}
 	return nil
@@ -485,6 +500,8 @@ func (m *DatabaseVerificationManager) deleteCredential(reference string) error {
 	if strings.TrimSpace(reference) == "" || m == nil || m.store == nil {
 		return nil
 	}
+	m.cleanupMu.Lock()
+	defer m.cleanupMu.Unlock()
 	ctx, cancel := context.WithTimeout(context.Background(), databaseVerificationCleanupTimeout)
 	defer cancel()
 	return m.store.Delete(ctx, reference)